REDHAT-BUG-1383211: Null Pointer Dereference

Published Oct 10, 2016

Updated

CVE-2016-8568

Read out-of-bounds in gitoidnfmt: https://github.com/libgit2/libgit2/issues/3936

CVE-2016-8569

DoS using a null pointer dereference in gitcommitmessage: https://github.com/libgit2/libgit2/issues/3937

Proposed patch:

https://github.com/libgit2/libgit2/pull/3956

Affected Software

1 affected component

Git libgit2

Oct 10, 2016

Data Sourced

via Red Hat·08:20 AM

DescriptionSeverityAffected Software

The severity of REDHAT-BUG-1383211 is categorized as high due to the potential for out-of-bounds read vulnerabilities.

To fix REDHAT-BUG-1383211, update to the latest version of libgit2 that addresses CVE-2016-8568.

The risks associated with REDHAT-BUG-1383211 include data leaks or application crashes due to out-of-bounds memory access.

Versions of libgit2 prior to the security fix for CVE-2016-8568 are affected by REDHAT-BUG-1383211.

Yes, there may be potential exploits available that leverage the out-of-bounds read vulnerability described in REDHAT-BUG-1383211.